The upload pipeline

The path a file takes

ask for an upload
  → grant: short-lived, one key, one size ceiling
  → send the bytes
  → held apart from everything else until you finalize
  → finalize → stored, with the SHA-256 computed from the bytes that arrived
  → file checks run against those exact bytes
  → the result decides what the model may do: publish, sell, stay private
  → each authorized download is signed per file

Each step authorizes only itself: stored bytes are not permission to publish, and publishing is not permission to download.

Upload

An upload starts with a grant: signed, short-lived permission to write one file, to one reserved key, up to a declared size. A small file goes in one request; a larger one goes in parts you can create, upload, complete or abandon. A model file can be up to 250 MiB.

Until you finalize, the bytes sit in a holding area nothing else can read. Finalizing moves the file into storage and records the SHA-256 of what actually arrived, so every later step is tied to those bytes. Moving a finished upload into storage takes a separate, server-held permission; a grant can only write to its own key.

Checks

Creating a model, or publishing a new version, queues a file check against the stored bytes. A fast client_advisory preflight runs first so you see something quickly; it can never grant eligibility or overwrite the full result.

• A small file is checked in place by benchy-mesh compiled to WASM.
• A larger file, or one that hits a limit there, is checked by the same engine running natively, with room for the largest model World accepts and full topology across millions of triangles, within bounded memory, CPU, output and time.
• A repeated request reuses the check already running for those bytes; a different declared unit gets its own result.
• A file beyond what the checks can cover stays stored and downloadable by you, but doesn't become publishable or purchasable.

Publishing

The finished report is stored with the file and applied to the model: the decision, which checks ran and how fully, the issue codes, observations and print readiness. A model that didn't pass can't be listed publicly or sold, and its file is kept either way; see Models and uploads. File checks passed appears only when a complete, current result is bound to the model's exact bytes, format and declared unit.

A file version that a World release depends on is never deleted.

Downloads

Every download needs you signed in. A paid file is checked against what you acquired: the exact release, its files and its license. Each authorized file gets its own short-lived signed link, with range support so a large file can resume. A link to a file you paid for, by purchase or membership, lasts about two minutes and allows only a few requests, so a refund or an ended membership stops new downloads within minutes. A free listing's file, or your own, gets a link that lasts up to 15 minutes. Unlisting a model stops discovery and sales but leaves everything already acquired downloadable.

See Building Benchy for why it is put together this way.